From 9a1d78078a4ec223274d7c5454596df5060c808f Mon Sep 17 00:00:00 2001 From: ialejandro <14978633+ialejandro@users.noreply.github.com> Date: Mon, 5 Oct 2026 03:41:08 +0000 Subject: [PATCH 1/3] fix: update dwpk version to 1.0.2 --- charts/dwpk/Chart.yaml | 2 +- charts/dwpk/README.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/dwpk/Chart.yaml b/charts/dwpk/Chart.yaml index 0870e54..a904194 100644 --- a/charts/dwpk/Chart.yaml +++ b/charts/dwpk/Chart.yaml @@ -10,7 +10,7 @@ sources: - https://github.com/devops-ia/helm-dwpk - https://github.com/devops-ia/dwpk version: 0.1.0 -appVersion: "1.0.0" +appVersion: 1.0.2 home: https://github.com/devops-ia/dwpk keywords: - kubernetes diff --git a/charts/dwpk/README.md b/charts/dwpk/README.md index 42fec99..fa9a7ee 100644 --- a/charts/dwpk/README.md +++ b/charts/dwpk/README.md @@ -1,6 +1,6 @@ # dwpk -![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.0.0](https://img.shields.io/badge/AppVersion-1.0.0-informational?style=flat-square) +![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.0.2](https://img.shields.io/badge/AppVersion-1.0.2-informational?style=flat-square) Development Workspace Platform for Kubernetes: a Go operator, an SSH gateway, and a marketplace web UI, deployed together by this chart. From dacd536c740823e44255913f252ce39fcfbe694e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Iv=C3=A1n=20Alejandro=20Marug=C3=A1n?= Date: Sat, 17 Oct 2026 18:42:48 +0200 Subject: [PATCH 2/3] fix: certificates --- .github/ct.yaml | 4 ++++ .github/workflows/helm-lint-test.yml | 2 ++ .../templates/cert-manager/serving-cert.yaml | 23 +++++++++++++++++++ charts/dwpk/templates/manager/manager.yaml | 6 ----- 4 files changed, 29 insertions(+), 6 deletions(-) diff --git a/.github/ct.yaml b/.github/ct.yaml index 2da3947..25c0938 100644 --- a/.github/ct.yaml +++ b/.github/ct.yaml @@ -8,3 +8,7 @@ upgrade: true validate-chart-schema: true validate-maintainers: false validate-yaml: true +# The dwpk manager holds its leader-election Lease in dwpk-system (hardcoded), +# so CI installs there instead of in a random namespace. +namespace: dwpk-system +release-label: app.kubernetes.io/instance diff --git a/.github/workflows/helm-lint-test.yml b/.github/workflows/helm-lint-test.yml index f88dfc9..c38acd2 100644 --- a/.github/workflows/helm-lint-test.yml +++ b/.github/workflows/helm-lint-test.yml @@ -9,3 +9,5 @@ jobs: permissions: contents: read uses: devops-ia/.github/.github/workflows/helm-lint-test.yml@main + with: + helm_extra_args: "--timeout 900s --create-namespace" diff --git a/charts/dwpk/templates/cert-manager/serving-cert.yaml b/charts/dwpk/templates/cert-manager/serving-cert.yaml index 49e20ed..fd85553 100644 --- a/charts/dwpk/templates/cert-manager/serving-cert.yaml +++ b/charts/dwpk/templates/cert-manager/serving-cert.yaml @@ -17,4 +17,27 @@ spec: kind: Issuer name: {{ include "dwpk.resourceName" (dict "suffix" "selfsigned-issuer" "context" $) }} secretName: webhook-server-cert +{{- else }} +{{- /* + The manager always starts its webhook server and exits without a serving + cert, so without cert-manager the chart ships a self-signed one. + ponytail: regenerated on every upgrade and no caBundle is injected into the + webhook configurations; use cert-manager when webhook.enabled is true. +*/}} +{{- $svc := include "dwpk.resourceName" (dict "suffix" "webhook-service" "context" $) }} +{{- $cert := genSelfSignedCert (printf "%s.%s.svc" $svc .Release.Namespace) nil (list (printf "%s.%s.svc" $svc .Release.Namespace) (printf "%s.%s.svc.cluster.local" $svc .Release.Namespace)) 3650 }} +apiVersion: v1 +kind: Secret +type: kubernetes.io/tls +metadata: + labels: + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/name: {{ include "dwpk.name" . }} + helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} + app.kubernetes.io/instance: {{ .Release.Name }} + name: webhook-server-cert + namespace: {{ .Release.Namespace }} +data: + tls.crt: {{ $cert.Cert | b64enc }} + tls.key: {{ $cert.Key | b64enc }} {{- end }} diff --git a/charts/dwpk/templates/manager/manager.yaml b/charts/dwpk/templates/manager/manager.yaml index e682207..842d751 100644 --- a/charts/dwpk/templates/manager/manager.yaml +++ b/charts/dwpk/templates/manager/manager.yaml @@ -118,9 +118,7 @@ spec: {{- range .Values.manager.args }} - {{ . }} {{- end }} - {{- if .Values.certManager.enabled }} - --webhook-cert-path=/tmp/k8s-webhook-server/serving-certs - {{- end }} command: {{- with .Values.manager.command }} {{- toYaml . | nindent 8 }} @@ -181,11 +179,9 @@ spec: {{- if .Values.manager.extraVolumeMounts }} {{- toYaml .Values.manager.extraVolumeMounts | nindent 10 }} {{- end }} - {{- if .Values.certManager.enabled }} - mountPath: /tmp/k8s-webhook-server/serving-certs name: webhook-certs readOnly: true - {{- end }} securityContext: {{- if .Values.manager.podSecurityContext }} {{- toYaml .Values.manager.podSecurityContext | nindent 8 }} @@ -200,9 +196,7 @@ spec: {{- if .Values.manager.extraVolumes }} {{- toYaml .Values.manager.extraVolumes | nindent 8 }} {{- end }} - {{- if .Values.certManager.enabled }} - name: webhook-certs secret: secretName: webhook-server-cert - {{- end }} {{- end }} From e36c8a24e423cf96d05142207d965fc941bdcdaf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Iv=C3=A1n=20Alejandro=20Marug=C3=A1n?= Date: Sat, 17 Oct 2026 19:10:06 +0200 Subject: [PATCH 3/3] fix: make chart-testing install pass in CI MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The install step failed for three reasons. ct installed main as the previous revision, and main has no webhook serving cert, so its manager crash-looped. The fixed dwpk-system namespace then kept secrets from that failed install and blocked the next one. And --create-namespace in helm_extra_args is also passed to helm uninstall, which rejects it. Go back to random namespaces, skip the upgrade test until 1.0.2 is released, and run one manager replica without leader election in CI, since its Lease lives in a hardcoded namespace. Co-Authored-By: Claude Sonnet 5.5 Signed-off-by: Iván Alejandro Marugán --- .github/ct.yaml | 6 +----- .github/workflows/helm-lint-test.yml | 2 -- charts/dwpk/ci/ct-values.yaml | 6 ++++++ 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/ct.yaml b/.github/ct.yaml index 25c0938..afda5c6 100644 --- a/.github/ct.yaml +++ b/.github/ct.yaml @@ -4,11 +4,7 @@ check-version-increment: false debug: false remote: origin target-branch: main -upgrade: true +upgrade: false validate-chart-schema: true validate-maintainers: false validate-yaml: true -# The dwpk manager holds its leader-election Lease in dwpk-system (hardcoded), -# so CI installs there instead of in a random namespace. -namespace: dwpk-system -release-label: app.kubernetes.io/instance diff --git a/.github/workflows/helm-lint-test.yml b/.github/workflows/helm-lint-test.yml index c38acd2..f88dfc9 100644 --- a/.github/workflows/helm-lint-test.yml +++ b/.github/workflows/helm-lint-test.yml @@ -9,5 +9,3 @@ jobs: permissions: contents: read uses: devops-ia/.github/.github/workflows/helm-lint-test.yml@main - with: - helm_extra_args: "--timeout 900s --create-namespace" diff --git a/charts/dwpk/ci/ct-values.yaml b/charts/dwpk/ci/ct-values.yaml index 85d0008..ba44685 100644 --- a/charts/dwpk/ci/ct-values.yaml +++ b/charts/dwpk/ci/ct-values.yaml @@ -18,3 +18,9 @@ prometheus: # previous release, so the next install fails on ownership metadata. crd: keep: false + +# CI only: leader election needs a Lease in a hardcoded namespace, and ct installs +# into random ones. A single replica does not need it. +manager: + replicas: 1 + args: []